CVE-2025-67873

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-67873
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-67873.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-67873
Aliases
  • GHSA-hj6g-v545-v7jg
Downstream
Related
Published
2025-12-17T21:12:13.739Z
Modified
2026-01-30T01:30:54.442865Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow
Details

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make csdisasm/csdisasmiter memcpy more than 24 bytes into csinsn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67873.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-122"
    ]
}
References

Affected packages

Git / github.com/capstone-engine/capstone

Affected ranges

Type
GIT
Repo
https://github.com/capstone-engine/capstone
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cbef767ab33b82166d263895f24084b75b316df3

Affected versions

1.*

1.0

2.*

2.0
2.0-rc1
2.1
2.1-rc1
2.1.1
2.1.2

3.*

3.0
3.0-rc1
3.0-rc2
3.0-rc3
3.0.1
3.0.1-rc1
3.0.1-rc2
3.0.2

4.*

4.0-alpha1
4.0-alpha2

6.*

6.0.0-Alpha1
6.0.0-Alpha3
6.0.0-Alpha4
6.0.0-Alpha5

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-67873.json"

vanir_signatures

[
    {
        "id": "CVE-2025-67873-2eded533",
        "source": "https://github.com/capstone-engine/capstone/commit/cbef767ab33b82166d263895f24084b75b316df3",
        "digest": {
            "length": 3407.0,
            "function_hash": "120005249773690817372286961807651630702"
        },
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "cs.c",
            "function": "cs_disasm"
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2025-67873-96f8ca92",
        "source": "https://github.com/capstone-engine/capstone/commit/cbef767ab33b82166d263895f24084b75b316df3",
        "digest": {
            "length": 1818.0,
            "function_hash": "263381900339651386714808960783944626214"
        },
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "cs.c",
            "function": "cs_disasm_iter"
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2025-67873-a9551169",
        "source": "https://github.com/capstone-engine/capstone/commit/cbef767ab33b82166d263895f24084b75b316df3",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "198397741915101271876594429176715452249",
                "178551590831113392981046669095220902750",
                "173369944453292519982397756480620497589",
                "130774544364814767540065253992691508408",
                "83649265652012454627825268866918203832",
                "166369049223699923858402334757367988201",
                "85209596397956414303677933237032917515",
                "310618838814994697821394253126533564489",
                "301759177527286800628400263923429828933",
                "182645681468710089829157874442623524633",
                "103577790663696292516803741825323825972",
                "170892149584398414070625942741937305060",
                "55375405304008644731933288301457859158",
                "789502981615529285216621930512497802",
                "168379687773373722681512146844363365551",
                "204582700926311727137842521227673261376",
                "250319065923885430497915467749286172685"
            ]
        },
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "cs.c"
        },
        "signature_type": "Line"
    }
]